Detection of PsExec Execution with the Accepteula Flag

PsExec is a legitimate administrative tool from the Sysinternals suite, frequently abused by threat actors for lateral movement and remote code execution within compromised environments. The use of the 'accepteula' flag is a specific artifact indicating that the tool is being executed on a host for the first time by a user, as it programmatically accepts the End User License Agreement. In a production environment, this event is highly unusual and often signals that an attacker is staging tools or establishing a foothold on a newly compromised system. Detection of this command-line argument provides high-fidelity insight into unauthorized administrative activity, which is a precursor to further exploitation, data exfiltration, or ransomware deployment by various advanced threat groups.

Impact

Successful abuse of PsExec allows an adversary to gain remote command execution capabilities under the context of the user running the tool. This frequently leads to lateral movement throughout the network, credential harvesting, and the potential deployment of ransomware. The capability is associated with numerous threat actors and ransomware campaigns, including but not limited to HAFNIUM, Volt Typhoon, Sandworm, and various ransomware groups such as Rhysida, Medusa, and DarkSide.

Recommendation

1. Deploy the provided Sigma rule to detect the execution of PsExec with the 'accepteula' flag.
2. Ensure endpoint logs (Sysmon Event ID 1 or Windows Event Log 4688) include full command-line arguments to facilitate this detection.
3. Investigate all alerts generated by this rule, as legitimate administrative use of PsExec with 'accepteula' should be infrequent on production systems.
4. Use the provided drilldown searches to correlate this process execution with other risk events for the involved user and destination host.